# CVEs published 2019-04-02

39 CVEs were published on April 2, 2019: 2 critical, 4 high. Days are UTC.

- [CVE-2018-18035](https://cve.now/CVE-2018-18035.md): A vulnerability in flashcanvas.swf in OpenEMR before 5.0.1 Patch 6 could allow an unauthenticated, remote attacker to conduct a cross-site s (no CVSS)
- [CVE-2019-6506](https://cve.now/CVE-2019-6506.md): SuiteCRM before 7.8.28, 7.9.x and 7.10.x before 7.10.15, and 7.11.x before 7.11.3 allows SQL Injection. (no CVSS)
- [CVE-2019-10714](https://cve.now/CVE-2019-10714.md): LocaleLowercase in MagickCore/locale.c in ImageMagick before 7.0.8-32 allows out-of-bounds access, leading to a SIGSEGV. (no CVSS)
- [CVE-2017-6047](https://cve.now/CVE-2017-6047.md): Detcon Sitewatch Gateway, all versions without cellular, Passwords are presented in plaintext in a file that is accessible without authentic (no CVSS, Detcon Sitewatch Gateway)
- [CVE-2017-6049](https://cve.now/CVE-2017-6049.md): Detcon Sitewatch Gateway, all versions without cellular, an attacker can edit settings on the device using a specially crafted URL. (no CVSS, Detcon Sitewatch Gateway)
- [CVE-2019-6531](https://cve.now/CVE-2019-6531.md): An attacker could retrieve passwords from a HTTP GET request from the Kunbus PR100088 Modbus gateway versions prior to Release R02 (or Softw (no CVSS, Kunbus PR100088 Modbus gateway)
- [CVE-2018-12680](https://cve.now/CVE-2018-12680.md): The Serialize.deserialize() method in CoAPthon 3.1, 4.0.0, 4.0.1, and 4.0.2 mishandles certain exceptions, leading to a denial of service in (no CVSS, coapthon)
- [CVE-2018-12679](https://cve.now/CVE-2018-12679.md): The Serialize.deserialize() method in CoAPthon3 1.0 and 1.0.1 mishandles certain exceptions, leading to a denial of service in applications (no CVSS, coapthon3)
- [CVE-2019-10708](https://cve.now/CVE-2019-10708.md): S-CMS PHP v1.0 has SQL injection via the 4/js/scms.php?action=unlike id parameter. (no CVSS)
- [CVE-2019-10707](https://cve.now/CVE-2019-10707.md): MKCMS V5.0 has SQL injection via the bplay.php play parameter. (no CVSS)
- [CVE-2018-19275](https://cve.now/CVE-2018-19275.md): The BluStar component in Mitel InAttend before 2.5 SP3 and CMG before 8.4 SP3 Suite Servers has a default password, which could allow remote (no CVSS)
- [CVE-2019-10692](https://cve.now/CVE-2019-10692.md): In the wp-google-maps plugin before 7.11.18 for WordPress, includes/class.rest-api.php in the REST API does not sanitize field names before (no CVSS)
- [CVE-2019-9946](https://cve.now/CVE-2019-9946.md): Cloud Native Computing Foundation (CNCF) CNI (Container Networking Interface) 0.7.4 has a network firewall misconfiguration which affects Ku (no CVSS)
- [CVE-2019-7474](https://cve.now/CVE-2019-7474.md): A vulnerability in SonicWall SonicOS and SonicOSv, allow authenticated read-only admin to leave the firewall in an unstable state by downloa (no CVSS, SonicWall SonicOS · SonicWall SonicOSv)
- [CVE-2019-7475](https://cve.now/CVE-2019-7475.md): A vulnerability in SonicWall SonicOS and SonicOSv with management enabled system on specific configuration allow unprivileged user to access (no CVSS, SonicWall SonicOS · SonicWall SonicOSv)
- [CVE-2019-7477](https://cve.now/CVE-2019-7477.md): A vulnerability in SonicWall SonicOS and SonicOSv TLS CBC Cipher allow remote attackers to obtain sensitive plaintext data when CBC cipher s (no CVSS, SonicWall SonicOS · SonicWall SonicOSv)
- [CVE-2018-15180](https://cve.now/CVE-2018-15180.md): qTest Portal in QASymphony qTest Manager 9.0.0 has an Open Redirect via the /portal/loginform redirect parameter. (no CVSS)
- [CVE-2018-4049](https://cve.now/CVE-2018-4049.md): An exploitable local privilege elevation vulnerability exists in the file system permissions of GOG Galaxy's “Games” directory, version 1.2. (CVSS 9.3, GOG.COM GOG Galaxy)
- [CVE-2018-4053](https://cve.now/CVE-2018-4053.md): An exploitable local denial-of-service vulnerability exists in the privileged helper tool of GOG Galaxy's Games, version 1.2.47 for macOS. (CVSS 6.2, GOG.COM GOG Galaxy)
- [CVE-2018-4051](https://cve.now/CVE-2018-4051.md): An exploitable local privilege escalation vulnerability exists in the privileged helper tool of GOG Galaxy's Games, version 1.2.47 for macOS (CVSS 7.1, GOG.COM GOG Galaxy)
- [CVE-2018-4052](https://cve.now/CVE-2018-4052.md): An exploitable local information leak vulnerability exists in the privileged helper tool of GOG Galaxy's Games, version 1.2.47 for macOS. (CVSS 6.2, GOG.COM GOG Galaxy)
- [CVE-2018-3974](https://cve.now/CVE-2018-3974.md): An exploitable local privilege elevation vulnerability exists in the file system permissions of GOG Galaxy's install directory. (CVSS 9.3, GOG.COM GOG Galaxy)
- [CVE-2019-5515](https://cve.now/CVE-2019-5515.md): VMware Workstation (15.x before 15.0.3, 14.x before 14.1.6) and Fusion (11.x before 11.0.3, 10.x before 10.1.6) updates address an out-of-bo (no CVSS, VMware Workstation and Fusion)
- [CVE-2019-5524](https://cve.now/CVE-2019-5524.md): VMware Workstation (14.x before 14.1.6) and Fusion (10.x before 10.1.6) contain an out-of-bounds write vulnerability in the e1000 virtual ne (no CVSS, VMware Workstation, VMware Fusion)
- [CVE-2019-1010260](https://cve.now/CVE-2019-1010260.md): Using ktlint to download and execute custom rulesets can result in arbitrary code execution as the served jars can be compromised by a MITM. (no CVSS, ktlint · com.github.shyiko.ktlint:ktlint-core)
- [CVE-2019-9759](https://cve.now/CVE-2019-9759.md): An issue was discovered in TONGDA Office Anywhere 10.18.190121. (no CVSS)
- [CVE-2019-4093](https://cve.now/CVE-2019-4093.md): IBM Tivoli Storage Manager (IBM Spectrum Protect 8.1.7) could allow a user to restore files and directories using IBM Spectrum Prootect Clie (CVSS 5.1, IBM Spectrum Protect)
- [CVE-2019-4080](https://cve.now/CVE-2019-4080.md): IBM WebSphere Application Server Admin Console 7.5, 8.0, 8.5, and 9.0 is vulnerable to a potential denial of service, caused by improper par (CVSS 6.5, IBM WebSphere Application Server)
- [CVE-2019-4043](https://cve.now/CVE-2019-4043.md): IBM Sterling B2B Integrator Standard Edition 5.2.0 snf 6.0.0.0 is vulnerable to an XML External Entity Injection (XXE) attack when processin (CVSS 7.1, IBM Sterling B2B Integrator)
- [CVE-2018-1917](https://cve.now/CVE-2018-1917.md): IBM InfoSphere Information Server 11.3, 11.5, and 11.7 could allow an authenticated user to access JSP files and disclose sensitive informat (CVSS 3.5, IBM InfoSphere Information Server)
- [CVE-2018-1906](https://cve.now/CVE-2018-1906.md): IBM InfoSphere Information Server 11.3, 11.5, and 11.7could allow an authenticated user to download code using a specially crafted HTTP requ (CVSS 4.3, IBM InfoSphere Information Server)
- [CVE-2018-1874](https://cve.now/CVE-2018-1874.md): IBM API Connect 5.0.0.0 through 5.0.8.5 could display highly sensitive information to an attacker with physical access to the system. (CVSS 4.6, IBM API Connect)
- [CVE-2018-1680](https://cve.now/CVE-2018-1680.md): IBM Security Privileged Identity Manager Virtual Appliance 2.2.1 does not require that users should have strong passwords by default, which (CVSS 5.9, IBM Security Privileged Identity Manager)
- [CVE-2018-1640](https://cve.now/CVE-2018-1640.md): IBM Security Privileged Identity Manager Virtual Appliance 2.2.1 could allow a remote authenticated attacker to execute arbitrary commands o (CVSS 8.8, IBM Security Privileged Identity Manager)
- [CVE-2018-1626](https://cve.now/CVE-2018-1626.md): IBM Security Privileged Identity Manager Virtual Appliance 2.2.1 does not renew a session variable after a successful authentication which c (CVSS 3.1, IBM Security Privileged Identity Manager)
- [CVE-2018-1625](https://cve.now/CVE-2018-1625.md): IBM Security Privileged Identity Manager Virtual Appliance 2.2.1 generates an error message that includes sensitive information about its en (CVSS 4.3, IBM Security Privileged Identity Manager)
- [CVE-2018-1623](https://cve.now/CVE-2018-1623.md): IBM Security Privileged Identity Manager Virtual Appliance 2.2.1 allows web pages to be stored locally which can be read by another user on (CVSS 4.0, IBM Security Privileged Identity Manager)
- [CVE-2018-1622](https://cve.now/CVE-2018-1622.md): IBM Security Privileged Identity Manager Virtual Appliance 2.2.1 is vulnerable to cross-site request forgery which could allow an attacker t (CVSS 4.3, IBM Security Privileged Identity Manager)
- [CVE-2018-1618](https://cve.now/CVE-2018-1618.md): IBM Security Privileged Identity Manager Virtual Appliance 2.2.1 could allow a remote attacker to traverse directories on the system. (CVSS 7.7, IBM Security Privileged Identity Manager)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2019-04-02
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.